Menu
Malware used in White House and State Department hacks possibly linked to Russia

Malware used in White House and State Department hacks possibly linked to Russia

The malware is related to the MiniDuke, CosmicDuke and OnionDuke cyberespionage tools, researchers from Kaspersky Lab found

The group of attackers behind cyberintrusions at the White House and the Department of State last year used malware that bears strong similarities to cyberespionage tools suspected to be of Russian origin.

Security researchers from Kaspersky Lab have dubbed the cyberespionage group CozyDuke and said that it has blatantly targeted high-profile victims since the second half of last year. Its toolset includes malware droppers, information-stealing programs and backdoors that have antivirus evasion capabilities and make use of cryptography, the researchers said Tuesday a blog post.

More importantly, technical evidence suggests that some of the CozyDuke malware has strong "functional and structural similarities" to known components of the MiniDuke, CosmicDuke and OnionDuke cyberespionage tools, the Kaspersky researchers said.

Those three threats have been used to attack NATO members and European governments over the past two years and are believed to be related.

While the Kaspersky researchers did not discuss CozyDuke's possible origins in their blog post, researchers from other companies who analyzed MiniDuke, CosmicDuke and OnionDuke in the past believe they are the work of the Russian government.

In a January blog post, researchers from F-Secure noted that none of the high-profile CosmicDuke or OnionDuke targets were from Russia. The only victims detected in Russia had links to illegal substances, suggesting that those spyware tools might be used in support of law enforcement investigations in the country.

"Considering the victims of the law enforcement use case seem to be from Russia, and none of the high-profile victims are exactly pro-Russian, we believe that a Russian government agency is behind these operations," the F-Secure researchers concluded.

The possible link between the State Department security breach last year and Russian hackers has been noted before. In February, the Wall Street Journal reported that five unnamed people familiar with the intrusion had seen or had been told of links between the malware used in the attack and the Russian government.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags intrusionsecuritydata breachf-securespywaremalwarekaspersky lab

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments